RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Address PR comments 

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
This commit is contained in:
egibs 2024-10-30 11:33:49 -05:00
parent 18e9879b01
commit 4abd265459
Failed to extract signature
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/c2/unexpected-talkers-macos.sql
View File

@ -112,5 +112,7 @@ WHERE pos.pid IN (
AND NOT ( AND NOT (
unsigned_exception = '500,0,0,chainlink,chainlink' unsigned_exception = '500,0,0,chainlink,chainlink'
AND p0.path LIKE '/var/folders/%/T/go-build%/b001/exe/chainlink' AND p0.path LIKE '/var/folders/%/T/go-build%/b001/exe/chainlink'
AND remote_port = 0
AND protocol = 0
) )
GROUP BY p0.cmdline GROUP BY p0.cmdline